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Intr tion 


The United States (U.S.) Department of Education (Department) is issuing these Frequently Asked 
Questions (FAQs) regarding the Family Educational Rights and Privacy Act (FERPA) and the 
coronavirus disease 2019, abbreviated as “COVID-19” and more commonly referred to as 
“coronavirus.”! We are working with our Federal partners including the Centers for Disease 
Control and Prevention (CDC), which is leading the Federal effort to address coronavirus or 
COVID-19. The U.S. Department of Health and Human Services (HHS) issued on January 31, 
2020, a declaration of a Public Health Emergency regarding coronavirus or COVID-19.? 


The Department’s Student Privacy Policy Office (SPPO) prepared this document to assist school 
officials working with public health officials in managing public health issues related to 
COVID-19, while protecting the privacy of students’ education records. Understanding FERPA 
helps enable school officials to act quickly and with certainty when confronting challenges that 
affect the health or safety of students or other individuals. 


Educational agencies and institutions, such as school districts, schools, colleges and universities, 
can play an important role in slowing the spread of COVID-19 in U.S. communities. Through 
information sharing and coordination with public health departments, educational agencies and 
institutions can help protect their schools and communities. 


The purpose of this document is to assist school officials in protecting student privacy in the 
context of COVID-19 as they consider the disclosure of personally identifiable information (PII) 
from student education records to individuals and entities who may not already have access to that 
information. School officials should work with their State and local public health officials to 
determine the information needed to address this public health concern. Understanding how, what, 
and when information can be shared is a critical part of preparedness. 


Background 


FERPA is a Federal law that protects the privacy of student education records. (20 U.S.C. § 
1232g; 34 C.F.R. Part 99) The law applies to all educational agencies and institutions that receive 
funds under any program administered by the Secretary of Education. The term “educational 
agencies and institutions” under FERPA generally includes school districts and public schools at 
the elementary and secondary levels, as well as private and public institutions of postsecondary 


' Please note that this FERPA & Coronavirus Disease 2019 (COVID-19) FAQ document updates the Department’s 
2009 FERPA & HIN1 document. Other than statutory and regulatory requirements included in the document, the 
contents of the guidance do not have the force and effect of law and are not meant to bind the public in any way. This 
document is intended only to provide clarity to the public regarding existing requirements under the law or agency 
policies. This document will be posted at https://studentprivacy.ed.gov and https://www.ed.gov/coronavirus. 

? HHS declaration posted at https://www.hhs.gov/about/news/2020/01/31/secretary-azar-declares-public-health- 
emergency-us-2019-novel-coronavirus.html. 


education. Private schools at the elementary and secondary levels generally do not receive funds 
from the Department and are, therefore, not subject to FERPA. 


FERPA gives parents certain rights with respect to their children’s education records at 
educational agencies and institutions to which FERPA applies. These rights transfer to the 
student when he or she reaches the age of 18 or attends an institution of postsecondary education 
at any age (thereby becoming an “eligible student’). 20 U.S.C. § 1232g(d); 34 C.F.R. § 
99.5(a)(1). Under FERPA, a parent or eligible student must provide a signed and dated written 
consent before an educational agency or institution discloses PII from education records, unless 
an exception to this general consent requirement applies. 34 C.F.R. § 99.30(a). Exceptions to the 
general consent requirement are set forth in 20 U.S.C. §§ 1232g(b)(1), (b)(2), (b)(3), (b)(5), 
(b)(6), (h), (4), and (j) and 34 C.F.R. § 99.31. The term “education records” is defined, with 
certain exceptions, as those records that are: (1) directly related to a student; and (2) maintained 
by an educational agency or institution, or by a party acting for the agency or institution. 20 
U.S.C. § 1232g(a)(4); 34 C.F.R. § 99.3, “Education records.” Accordingly, immunization and 
other health records, as well as records on services provided to students under the Individuals 
with Disabilities Education Act (IDEA), which are directly related to a student and maintained by 
an educational agency or institution are “education records” under FERPA.’ The term “PII” refers 
to a student’s name or identification number, as well as other information that can be used to 
distinguish or trace an individual’s identity either directly or indirectly through linkages with 
other information. 34 C.F.R. § 99.3, “Personally identifiable information.” 


FERPA prohibits educational agencies (e.g., school districts) and institutions (i.e., schools) from 
disclosing PI from students’ education record without the prior written consent of a parent or 
“eligible student,” unless an exception to FERPA’s general consent rule applies. 20 U.S.C. §§ 
1232g(b)(1) and (b)(2); 34 C.F.R. §§ 99.30 and 99.31. For instance, pursuant to one such 
exception, the “health or safety emergency” exception, educational agencies and institutions may 
disclose to a public health agency PII from student education records, without prior written 
consent in connection with an emergency if the public health agency’s knowledge of the 
information is necessary to protect the health or safety of students or other individuals. 20 U.S.C. 
§ 1232g(b)(1)(); 34 C.F.R. §§ 99.31(a)(10) and 99.36. 


For all other situations where an exception to FERPA’s general consent requirement does not 
apply, educational agencies and institutions must obtain prior written consent of a parent or 
eligible student to disclose PII from student education records. 20 U.S.C. §§ 1232g(b)(1) and 
(b)(2); 34 C.F.R. §§ 99.30 and 99.31. We have attached a model consent form at the end of this 
document. We have also listed the email and contact information for SPPO, the Department office 
responsible for implementing and enforcing FERPA, if school officials have questions that are not 
covered in this document. 


3 Parts B and C of the IDEA contain separate privacy regulations that incorporate FERPA provisions and exceptions, 
including the health or safety emergency exception that is the primary subject of these FAQs. Where a student is placed 
in a private school for the provision of Individualized Education Program (IEP) services on behalf of a school or school 
district subject to FERPA, the education records of the privately placed student that are maintained by the private 
school are subject both to FERPA and to the confidentiality requirements under Part B of the IDEA. 

2 


C'Coronavirus") 


1. Do parents and eligible students have to provide consent before an educational 
agency or institution discloses PII from education records? 


Generally, yes. A parent or eligible student must provide written consent before an educational 
agency or institution discloses PII from a student’s education records, unless one of the exceptions 
to FERPA’s general consent rule applies. 20 U.S.C. §§ 1232g(b)(1) and (b)(2); 34 C.F.R. §§ 99.30 
and 99.31. FERPA requires that a consent form be signed and dated by a parent or eligible student 
and (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) 
identify the party or class of parties to whom the disclosure may be made. 34 C.F.R. § 99.30(a) 
and (b). At the conclusion of this document, we have included a sample FERPA consent form. 


2. How does the health or safety emergency exception to FERPA’s consent requirement 
permit an educational agency or institution to disclose PII from the education records 
of affected students? 


Although educational agencies and institutions can often address threats to the health or safety 
of students or other individuals in a manner that does not identify a particular student, FERPA 
permits educational agencies and institutions to disclose, without prior written consent, PII from 
student education records to appropriate parties in connection with an emergency, if knowledge 
of that information is necessary to protect the health or safety of a student or other individuals. 
20 U.S.C. § 1232g(b)(1)(1); 34 C-F.R. §§ 99.31(a)(10) and 99.36. This “health or safety 
emergency” exception to FERPA’s general consent requirement is limited in time to the period 
of the emergency and generally does not allow for a blanket release of PII from student 
education records. Typically, law enforcement officials, public health officials, trained medical 
personnel, and parents (including parents of an eligible student) are the types of appropriate 
parties to whom PII from education records may be disclosed under this FERPA exception. 


For purposes of FERPA’s health or safety emergency exception, the determination by an 
educational agency or institution that there is a specific emergency is not based on a generalized 
or distant threat of a possible or eventual emergency for which the likelihood of occurrence is 
unknown, such as would be addressed in general emergency preparedness activities. If local 
public health authorities determine that a public health emergency, such as COVID-19, is a 
significant threat to students or other individuals in the community, an educational agency or 
institution in that community may determine that an emergency exists as well. 


Under the FERPA health or safety emergency exception, an educational agency or institution is 
responsible for making a determination, on a case-by-case basis, whether to disclose PII from 
education records, and it may take into account the totality of the circumstances pertaining to the 
threat. See 34 C.F.R. § 99.36(c). If the educational agency or institution determines that there is an 
articulable and significant threat to the health or safety of the student or another individual and 
that certain parties need the PII from education records, to protect the health or safety of the 
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student or another individual, it may disclose that information to such parties without consent. 
This is a flexible standard under which the Department will not substitute its judgment for that of 
the educational agency or institution so that the educational agency or institution may bring 
appropriate resources to bear on the situation, provided that, based on the information available at 
the time of the educational agency’s or institution’s determination, there is a rational basis for 
such determination. We note also that, within a reasonable period of time after a disclosure is 
made under this exception, an educational agency or institution must record in the student’s 
education records the articulable and significant threat that formed the basis for the disclosure and 
the parties to whom information was disclosed. 34 C.F.R. § 99.32(a)(5). 


3. May student education records, such as health records, maintained by an educational 
agency or institution be disclosed, without consent, to public health departments if the 
educational agency or institution believes that the virus that causes COVID-19 poses a 
serious risk to the health or safety of an individual student in attendance at the 
educational agency or institution? 


Yes. If an educational agency or institution, taking into account the totality of the circumstances, 
determines that an articulable and significant threat exists to the health or safety of a student in 
attendance at the agency or institution (or another individual at the agency or institution) as a 
result of the virus that causes COVID-19, it may disclose, without prior written consent, PI from 
student education records to appropriate officials at a public health department who need the 
information to protect the health or safety of the student (or another individual). Public health 
department officials may be considered “appropriate parties” by an educational agency or 
institution under FERPA’s health or safety emergency exception, even in the absence of a 
formally declared health emergency. Typically, public health officials and trained medical 
personnel are among the types of appropriate parties to whom PII from education records, may be 
non-consensually disclosed under FERPA’s health or safety emergency exception. 


4. Ifan educational agency or institution learns that student(s) in attendance at the 
school are out sick due to COVID-19, may it disclose information about the 
student’s illness under FERPA to other students and their parents in the school 
community without prior written parental or eligible student consent? 


It depends, but generally yes, but only if that information is in a non-personally identifiable form. 
Specifically, the the educational agency or institution must make a reasonable determination that a 
student’s identity is not personally identifiable, whether through single or multiple releases, and 
taking into account other reasonably available information. See 34 C.F.R. § 99.31(b)(1). If an 
educational agency or institution discloses information about students in non-personally 
identifiable form, then consent by the parents or eligible students is not needed under FERPA. For 
example, if an educational agency or institution releases the fact that individuals are absent due to 
COVID-19 (but does not disclose their identities), this would generally not be considered 
personally identifiable to the absent students under FERPA as long as there are other individuals 
at the educational agency or institution who are absent for other reasons. However, we caution 
educational agencies or institutions to ensure that in releasing such facts, they do so in a manner 
that does not disclose other information that, alone or in combination, would allow a reasonable 
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person in the school community to identify the students who are absent due to COVID-19 with 
reasonable certainty. 


5. May educational agencies and institutions disclose without consent the names, addresses, 
and phone numbers of absent students to the public health department so that the health 
department may contact their parents in order to assess the students’ illnesses? 


FERPA permits educational agencies and institutions to non-consensually disclose PII from 
education records in the form of contact information of absent students to the public health 
department in specific circumstances, such as in connection with a health or safety emergency 
(20 U.S.C. § 1232g(b)(1)(D; 34 C.F.R. §§ 99.31(a)(10) and 99.36) or pursuant to other applicable 
exceptions. 


While FERPA generally permits the nonconsensual disclosure of properly designated “directory 
information” (e.g., name, address, phone number, grade level) when parents or eligible students 
have not opted out of such a disclosure, it does not permit an educational agency or institution to 
disclose “directory information” on students that is linked to non-directory information (such as 
information regarding a student’s illness). For instance, an educational agency or institution may 
not disclose directory information on all students who are receiving special education services or 
those who have been absent from school. 


Therefore, unless a specific FERPA exception applies, educational agencies and institutions 
should prepare consent forms for parents and eligible students to sign to allow the potential 
sharing of this type of information if they create, or intend to create, a tracking or monitoring 
system to identify an outbreak before an emergency is recognized. 


6. If an educational agency or institution determines that a health or safety emergency 
exists, may it disclose, without consent, PII from student education records to the 
media? 


No. As explained previously, FERPA only permits nonconsensual disclosures of PII from 
students’ education records under the health or safety emergency exception to “appropriate 
parties” (such as public health officials) whose knowledge of the information is necessary to 
protect the health or safety of students or other individuals. While the media may have a role in 
alerting the community of an outbreak, they are not “appropriate parties” under FERPA’s health 
or safety emergency exception because they generally do not have a role in protecting individual 
students or other individuals at the educational agency or institution. “Appropriate parties” in this 
context are normally parties who provide specific medical or safety attention, such as public 
health and law enforcement officials. 


7. May the school identify a particular student, a teacher, or other school official as having 
COVID-19 to parents of other students in the school? 


In most cases, it is sufficient to report the fact that an individual in the school has been 
determined to have COVID-19, rather than specifically identifying the student who is infected. 
School notification is an effective method of informing parents and eligible students of an illness 
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in the school. For settings in which parents are primarily doing drop-offs and pick-ups, posting 
signs on the doors may be effective. In other settings, sending home or e-mailing a notification 
may also be effective. These methods serve to notify parents and eligible students of a potential 
risk, which may be particularly important for students who may be more susceptible to infection 
or to developing severe complications from an infection, and to alert parents to look for 
symptoms in their own children and eligible students to more closely monitor themselves for 
symptoms. 


Nothing in FERPA prevents schools from telling parents and students that a specific teacher or 
other school official has COVID-19 because FERPA applies to students’ education records, not 
records on school officials. However, there may be State laws that apply in these situations. 


There may be a rare situation during a health or safety emergency, however, in which schools 
may determine (in conjunction with health, law enforcement, or other such officials) that parents 
of students or eligible students are appropriate parties to whom to disclose identifiable 
information about a student with COVID-19. For example, school officials may determine that it 
is appropriate to disclose identifiable information about of a student with COVID-19 to parents 
of other students if parents need to know this information to take appropriate action to protect the 
health or safety of their children. For example if a student with COVID-19 is a wrestler and has 
been in direct and close contact with other students who are on the team or who are in the school 
and have higher health risks, school officials may determine it necessary to disclose the identity 
of the diagnosed student to the parents of the other students. In these limited situations, parents 
and eligible students may need to be aware of this information in order to take appropriate 
precautions or other actions to ensure the health or safety of their child or themselves, especially 
if their child or they may have a higher risk of susceptibility to COVID-19 or of developing 
severe complications from COVID-19.* School officials should make the determination on a 
case-by-case basis whether a disclosure of the student’s name is absolutely necessary to protect 
the health or safety of students or other individuals or whether a general notice is sufficient, 
taking into account the totality of the circumstances, including the needs of such students or 
other individuals to have such information in order to take appropriate protective action(s) and 
the risks presented to the health or safety of such students or other individuals. 


8. May an educational agency or institution disclose PII from an eligible student’s 
education records to the student’s parents if the eligible student has been determined to 
have COVID-19? 


Yes, for dependent students and generally yes, but see below. Under FERPA, an educational 
agency or institution, including an institution of postsecondary education, may disclose, without the 
eligible student’s written consent, PI from an eligible student’s education records to his or her 
parents under certain conditions. For example, a university physician treating an eligible student for 
COVID-19 might determine that the student’s treatment records should be disclosed to the 
student’s parents. This disclosure may be made, without consent of the eligible student, if the 
parents claim the eligible student as a dependent under section 152 of the Internal Revenue Code of 


‘ For helpful information on risk, please see the Centers for Disease Control and Prevention’s current risk assessment, 
which is available at: https://www.cdc.gov/coronavirus/2019-ncov/specific-groups/children-faq.html. 
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1986. 20 U.S.C. § 1232g(b)(1)(H); 34 C.F.R. § 99.31(a)(8). If the parents do not claim the eligible 
student as a dependent, then the disclosure may be made to the parents, without the eligible 
student’s written consent, if the disclosure is in connection with a health or safety emergency 
provided certain conditions are satisfied (as discussed in the response to question two above). 20 
U.S.C. § 1232g(b)(1)(D; 34 C.F.R. §§ 99.31(a)(10) and 36. 


9. What if a parent of a student who is not an eligible student refuses to provide written 
consent to permit the release of PII contained in student education records to the public 
health department? 


FERPA permits educational agencies and institutions to release information from education 
records without consent after the removal of all PI, provided that the agency or institution has 
made a reasonable determination that a student’s identity is not personally identifiable, whether 
through single or multiple releases, and taking into account other reasonably available 
information. 34 C.F.R. § 99.31(b)(1). Thus, it would be problematic to disclose that every student 
in a particular class or grade level is absent if there is, for instance, a directory with the names of 
every student in that class or grade. Therefore, it is prudent that educational agencies or 
institutions obtain written consent to permit the disclosure of PII from students’ education records 
to the public health department. If the parent or eligible student will not provide written consent 
for the disclosure of the PII, then the educational agency or institution may not make the 
disclosure unless it has determined that there is an applicable exception to the general 
requirement of consent that permits the disclosure, such as if a health or safety emergency exists 
and the PII is disclosed to an appropriate party whose knowledge of the information is necessary 
to protect the health or safety of the student or other individuals. 


10. Is an educational agency or institution required to record disclosures of PII from student 
education records submitted to the public health department or other outside parties, 
even in connection with a health or safety emergency? 


Yes. FERPA generally requires educational agencies and institutions to maintain a record of each 
request for access to and each disclosure of PII from the education records of each student. 34 
C.F.R. § 99.32(a)(1). Moreover, when making a disclosure under the health or safety emergency 
provision in FERPA, educational agencies and institutions are specifically required to record the 
articulable and significant threat to the health or safety of a student or other individual that formed 
the basis for the disclosure and the parties to whom the agency or institution disclosed the 
information. 34 C.F.R. § 99.32(a)(5). The record of each request for access to and each disclosure 
of PI from student education records must be maintained with the education records of each 
student as long as the records are maintained. 34 C.F.R. § 99.32(a)(2). This requirement enables 
parents and eligible students who do not provide written consent for disclosure of education 
records to see the circumstances under which and the parties to whom their information was 
disclosed. However, educational agencies and institutions are not required to record disclosures 
for which the parent or eligible student has provided written consent. 34 C.F.R. § 99.32(d)(3). 
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The Department’s Student Privacy Policy Office or SPPO is the office that administers FERPA. 
SPPO is available to respond to questions school officials may have about FERPA. School 
officials may e-mail questions to SPPO at FERPA@ed.gov. You may also call us at (202) 260- 
3887. Additional information and guidance on FERPA is available on SPPO’s website at: 
https://studentprivacy.ed.gov/. 


The Department has a list of resources regarding COVID-19 (coronavirus) on our website at 
https://www.ed.gov/coronavirus. Questions related to the coronavirus may be emailed to the 
Department at COVID-19@ed.gov. 


In December 2019, the U.S. Department of Education, along with HHS, issued guidance on the 
applicability of FERPA and the HIPAA to student health records, the “Joint Guidance on the 
Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) To Student Health Records.” See 
https://studentprivacy.ed.gov/sites/default/files/resource_document/file/2019%20HIPAA%20FER 
PA%20Joint%20Guidance%20508.pdf. This 2019 document updated the Department’s 2008 
guidance and explained that the HIPAA Privacy Rule does not apply to education records that are 
protected by FERPA. Student health records that are maintained by a public elementary and 
secondary educational agency or institution or by a party acting for the agency or institution are 
“education records” subject to FERPA, and school officials must follow the requirements of 
FERPA in making any disclosures of the PII from these records. At the postsecondary level, 
FERPA applies to most public and private institutions of postsecondary education and to the 
student health records that they maintain. Such student health records may either constitute 
“education records” or “treatment records,” if certain conditions are met, but in either case they 
are subject to FERPA and not the HIPAA Privacy Rule. 


For more information on the HIPAA Privacy Rule, please visit HHS’ HIPAA Privacy Rule 
website at: http://www.hhs.gov/ocr/privacy/. The website offers a wide range of helpful 
information about the HIPAA Privacy Rule, including frequently asked questions. 


[Sample FERPA Consent Form] 


Disclosure of Information Protected by the Family Educational Rights and Privacy Act 
by [Name of School/School District] to [Name of Appropriate Authority] 


Pursuant to the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232; 34 
C.F.R. part 99), the written consent of a parent or eligible student is required before the education 
records of a student, or personally identifiable information contained therein, may be disclosed to 
a third party, unless an exception to this general requirement of written consent applies. Ifa 
student is age 18 years or older, or is enrolled in an institution of postsecondary education, he or 
she is an “eligible student” and must provide written consent for the disclosure of his or her 
education records or personally identifiable information contained therein. 


I; , hereby agree to allow 
[SCHOOL OR DISTRICT NAME] to disclose the following personally identifiable information 
or education records: 


[Specify education records or personally identifiable 
information that may be disclosed] on 
[Name of Student] to [Name of Appropriate Authority] for the 
purpose of [State purpose of disclosure] ‘ 


You may withdraw your consent to share this information at any time. A request to withdraw your 
consent should be submitted in writing and signed. 


Signature of Parent, Guardian, or Eligible Student 


Date: 


